Examkin

Question

Difficulty: HardNetwork Security and Private Access

An enterprise is designing a secure network architecture in Azure for a processing workload. The architecture contains:

- A subnet named Subnet-Workload hosting several Virtual Machines (VMs) that do not have public IP addresses.
- An Azure Storage account containing critical data that the VMs must access.
- An Azure SQL Database that the VMs must query.

The design must satisfy the following security and administrative constraints:
- Direct administrative RDP/SSH access to the VMs must be provided securely without provisioning public IPs on the VMs, utilizing a fully managed PaaS solution.
- All database and storage traffic from the VMs must utilize private IP addresses within the virtual network and bypass the public internet.
- Network security rules must restrict outbound traffic from Subnet-Workload to only allowed Azure services with minimal maintenance overhead.
- Virtual network routing must not disrupt default traffic flow within the virtual network.

Which two solutions should you include in the architecture? (Select two.)

  1. Deploy Azure Bastion in a dedicated subnet named AzureBastionSubnet to manage VM access.Answer
  2. Deploy Private Endpoints for the Azure SQL Database and the Azure Storage account in the virtual network.Answer
  3. C
    Configure NSG rules on Subnet-Workload that allow outbound traffic using manually defined public IP address ranges for Azure SQL and Azure Storage.
  4. D
    Create User-Defined Routes (UDRs) on Subnet-Workload that redirect all subnet traffic, including local virtual network traffic, through a virtual network gateway.

Answer

Deploy Azure Bastion in a dedicated subnet named AzureBastionSubnet to manage VM access, and deploy Private Endpoints for the Azure SQL Database and the Azure Storage account in the virtual network.
Deploying Azure Bastion in a dedicated subnet enables secure administrative access via RDP and SSH directly from the Azure portal over TLS, eliminating the need for public IPs on the workload VMs. Deploying Private Endpoints for the Azure SQL Database and the Azure Storage account assigns private IP addresses from the virtual network to these services, securing the traffic on Microsoft's backbone network and eliminating exposure to the public internet.

Step-by-Step Solution

1
Evaluate the administrative access requirement to determine the most secure, low-overhead solution.
Azure Bastion is identified as the optimal fully managed PaaS solution to provide RDP/SSH access without public IPs.
This satisfies the constraint of secure administrative access without public IP addresses and with minimal effort.
2
Determine the secure private access mechanism for Azure SQL Database and Azure Storage.
Private Endpoints are selected to assign private IP addresses to these services within the virtual network.
This ensures all data traffic is kept off the public internet and conforms to the private access requirement.
3
Analyze the network security group requirements for service traffic.
Service Tags should be used instead of manually defined public IP address ranges.
Using individual IP rules increases operational complexity and violates the constraint of minimal maintenance overhead.
4
Verify routing requirements to ensure internal connectivity is preserved.
Default system routing is maintained without introducing overlapping custom user-defined routes that block local traffic.
This avoids breaking internal communications within the virtual network.

Key Concept

Designing secure administrative access and private access to Azure resources using Azure Bastion and Private Endpoints, while avoiding administrative overhead in routing and network security groups.
Estimated Time:2m 30s
Rate this question

Topics

Network Security and Private Access

More questions from this topic